Messages in this thread | | | Date | Fri, 4 Sep 2009 09:46:26 +0200 | From | Ingo Molnar <> | Subject | Re: [PATCH V3] x86: NX protection for kernel data |
| |
* Siarhei Liakh <sliakh.lkml@gmail.com> wrote:
> This patch expands functionality of CONFIG_DEBUG_RODATA to set main > (static) kernel data area as NX. > The following steps are taken to achieve this: > 1. Linker script is adjusted so .text always starts and ends on a page boundary > 2. Linker script is adjusted so .rodata and .data always start and > end on a page boundary > 3. void mark_nxdata_nx(void) added to arch/x86/mm/init.c with actual > functionality: NX is set for all pages from _etext through _end. > 4. mark_nxdata_nx() called from free_initmem() (after init has been released) > 5. free_init_pages() sets released memory NX in arch/x86/mm/init.c > > The patch have been developed for Linux 2.6.31-rc7 x86 by Siarhei Liakh > <sliakh.lkml@gmail.com> and Xuxian Jiang <jiang@cs.ncsu.edu>. > > V1: initial patch for 2.6.30 > V2: patch for 2.6.31-rc7 > V3: moved all code into arch/x86, adjusted credits
ok, i like it.
One small cleanliness detail before we can apply it to the x86 tree:
> --- a/arch/x86/mm/init.c > +++ b/arch/x86/mm/init.c > @@ -440,11 +441,31 @@ void free_init_pages(char *what, unsigned long > begin, unsigned long end) > #endif > } > > +#ifndef CONFIG_DEBUG_RODATA > +static inline void mark_nxdata_nx(void) { } > +#else > +void mark_nxdata_nx(void) > +{ > + /* > + * When this called, init has already been executed and released, > + * so everything past _etext sould be NX. > + */ > + unsigned long start = PFN_ALIGN(_etext); > + unsigned long size = PFN_ALIGN(_end) - start; > + > + printk(KERN_INFO "NX-protecting the kernel data: %lx, %lu pages\n", > + start, size >> PAGE_SHIFT); > + set_pages_nx(virt_to_page(start), size >> PAGE_SHIFT); > +} > +#endif
This #ifdef looks ugly, it starts with an #ifndef which is inverted logic and mark_nxdata_nx() is a global symbol, needlessly. It should be written as something like:
static void mark_nxdata_nx(void) { #ifdef CONFIG_DEBUG_RODATA ... #endif }
Thanks,
Ingo
| |